New this week in breach news: glaring oversights lead to data disasters, ransomware puts governance out of action, and a new study shows the enormous cost of data breaches.
This Week in Breach: Dark Web ID’s Top Threats
- Top Source Hits: ID Theft Forums
- Top Compromise Type: Domain
- Top Industry: Education & Research
- Top Employee Count: 501+
The Week in Breach: United States
United States – Westech International
Exploit: Ransomware
Westech International: Nuclear maintenance subcontractor
Risk to Small Business: 1.510 = Severe
Cybercriminals associated with the MAZE ransomware group exfiltrated company data before encrypting certain networks. The stolen files were subsequently posted online. Westech International is working with cybersecurity experts to identify the scope of the incident and restore access to encrypted data. In the meantime, the company will likely face significant fallout as its business relies on an industry that demands the highest cybersecurity standards.
Individual Risk: 2.279 = Severe
The company did not detail the specific information compromised in the breach, but the incident includes company emails and payroll information, which likely contain personal and financial data. Anyone impacted by this breach should immediately notify their financial institutions while taking steps to protect their personal information against misuse.
Customers Impacted: Unknown
How it Could Affect Your Customers’ Business: Stolen data can be quickly disseminated on the Dark Web. To combat data misuse and to prevent further cybersecurity incidents, today’s organizations need insight into this nefarious marketplace. With information traveling quickly among bad actors, it could be the difference between stopping further misuse and succumbing to a more problematic cybersecurity incident.
ID Agent to the Rescue: Dark Web ID monitors the Dark Web to find out if your employee or customer data has been compromised. We work with MSSPs to strengthen their security suite by offering industry-leading detection. Discover more at https://www.idagent.com/dark-web/.
United States – Joomla
Exploit: Unsecured database
Joomla: Content management system
Risk to Small Business: 1.708 = Severe
Developers failed to secure backup files on a cloud storage platform, leaving people’s personal data exposed to the internet. The storage platform doesn’t automatically encrypt data, but enabling these security features is simple, making this incident an unforced error that was easily preventable. While the platform has secured the database, this breach will test users’ loyalty at a time when people are more willing than ever to leave businesses that can’t protect their information.
Individual Risk: 2.675 = Severe
The data breach exposed personally identifiable information, including names, addresses, phone numbers, website addresses, business titles, encrypted passwords, IP addresses, and newsletters subscription preferences. Users should update their Joomla account passwords and any other account credentials using the same details. In addition, they need to carefully monitor incoming messages as this information is often used in phishing scams.
Customers Impacted: 2,700
How it Could Affect Your Customers’ Business: Billions of account credentials are compromised every year. Companies committed to cybersecurity shouldn’t rely exclusively on password integrity to protect their most critical information. Instead, make account security tools, like two-factor authentication, accessible for all employees.
ID Agent to the Rescue: Dark Web ID can find out how your staff’s stolen sensitive data is being used on the Dark Web, with customized options to add special alerts for executives and administrators. Find out more here: https://www.idagent.com/dark-web/.
United States – San Francisco Employees’ Retirement System (SFERS)
Exploit: Unauthorized database access
SFERS: Public employee benefits program
Risk to Small Business: 1.980 = Severe
An unauthorized user accessed a critical database managed by the program’s third-party vendor, causing a significant data breach. The breach, which occurred on February 24, 2020, wasn’t discovered until the end of March. An analysis of the incident couldn’t be completed until this month, leaving many people unaware that their information might be compromised. This data breach reveals the cybersecurity risk that accompanies third-party partnerships but also the often-lengthy delay between breach identification and notification.
Individual Risk: 2.602 = Moderate
The data breach did not compromise Social Security numbers or bank data, but it did include members’ names, addresses, dates of birth, and beneficiary information. This data can be used in a variety of different cybercrimes. Most notably, cybercriminals are using stolen data to craft spear phishing messages that can result in even more problematic cybersecurity incidents.
Customers Impacted: 74,000
How it Could Affect Your Customers’ Business: Third-party vendors are an inevitable part of doing business in 2020. However, these relationships expose companies to potential data breaches that are outside of their control. In this environment, having an extra layer of protection to prevent network or account access is a critical component of any defensive strategy.
ID Agent to the Rescue: Vendor or service provider mistakes can be a problem, but they don’t have to be your problem. Breathe easier with a digital risk protection platform that’s up to the challenge of protecting you from other companies’ mistakes. https://www.idagent.com/passly-digital-risk-protection
The Week in Breach: Canada
Canada – The Nipissing First Nation
Exploit: Ransomware
The Nipissing First Nation: Administration for First Nations Tribe
Risk to Small Business: 1.702 = Severe
A ransomware attack disrupted communications throughout the administration and resource network. The attack, which was first detected on May 8th, was partially thwarted when the organization prevented it from encrypting networks, communications infrastructure was impacted. To repair the damage, Nipissing First Nation hired a cybersecurity team to investigate the cause and to identify solutions. Despite avoiding some of the worst consequences, the organization will still face an expensive recovery process that will impact its operations at a critical time.
Individual Risk: At this time, no personal information was compromised in the breach.
Customers Impacted: Unknown
How it Could Affect Your Customers’ Business: While cybersecurity specialists believe that company and customer data was spared in this attack, ransomware attacks often double as data breaches when bad actors exfiltrate data before encrypting networks. Organizations should regularly assess their defensive landscape to ensure that they are prepared to defend against the latest ransomware trends.
ID Agent to the Rescue: Helping your SMB customers understand the importance of security is no easy task. With Goal AssistTM, we offer hands-on assistance with your direct sales interactions, setting you up for the win by providing the resources necessary to make a case for Dark Web monitoring. Learn more here: https://www.idagent.com/goal-assist.
Canada – The Manitoba Agricultural Services Corporation (MASC)
Exploit: Accidental data sharing
MASC: Agriculture products and services provider
Risk to Small Business: 2.847 = Moderate
An employee accidentally attached a document containing the names and contact information for more than 130 clients. The incident is an embarrassing oversight, requiring MASC to notify its clients of the self-inflicted data breach. In response to the breach, MASC acknowledged that it’s implementing new policies and procedures to guard against a similar data breach in the future. However, there is no guarantee that these steps will assuage clients, who could shy away from partnering with organizations without data security processes in place from day one.
Individual Risk: 2.922 = Moderate
The breach exposed organizational contact information, which could include certain employees’ personal data. This information can be used to craft convincing phishing scams, and employees should carefully evaluate the authenticity of incoming communications.
Customers Impacted: 134
How it Could Affect Your Customers’ Business: As we’ve reported on our blog, accidental and malicious insider threats pose a meaningful data privacy risk to every organization. While many organizations are rightly focused on external cyber threats, it’s important to account for a 360-degree approach to cybersecurity that includes effective policies and procedures to prevent insider threats from compromising company data.
ID Agent to the Rescue: Helping your SMB customers understand the importance of security is no easy task. With Goal Assist we offer hands-on assistance with your direct sales interactions, setting you up for the win by providing the resources necessary to make a case for Dark Web monitoring. Learn more here: https://www.idagent.com/goal-assist.
The Week in Breach: EU & UK
Spain – 8Belts
Exploit: Unsecured database
8Belts: Online learning platform
Risk to Small Business: 2.161 = Severe
Developers failed to secure an Amazon Web Services S3 bucket, exposing users’ personal data to the open internet. The database includes both critical company files and users’ personal information, making it an especially problematic cybersecurity incident for the company. 8Belt frequently partners with prominent organizations to provide educational services, and this data breach could jeopardize those important relationships. In response, the company will need to undergo a significant PR effort to restore customer confidence, an effort that is undoubtedly predicated on the reprioritization of data privacy.
Risk to Small Business: 1.710 = Severe
This data breach impacts both staff and students of the online learning platform. It includes their names, email addresses, phone numbers, dates of birth, National ID numbers, and Skype IDs. Those impacted need to carefully scrutinize income messages, as compromised data often reemerges in convincing-looking spear phishing campaigns that can compromise even more sensitive data.
Customers Impacted: 150,000
How it Could Affect Your Customers’ Business: Billions of records are routinely compromised through accidental and malicious data exposure. This data is fodder for phishing scams, which rely on personal information to craft authentic-looking messages that inspire engagement. In response, every company needs a robust, dynamic phishing scam awareness program to ensure that these malicious messages don’t compromise company data.
ID Agent to the Rescue: BullPhish ID simulates phishing attacks and conducts security awareness training campaigns to educate your employees, including video content available in 8 languages, making them the best defense against phishing attacks for your business. https://www.idagent.com/bullphish-id.
United Kingdom – NHS Orkney
Exploit: Accidental data sharing
NHS Orkney: Healthcare provider
Risk to Small Business: 1.974 = Severe
An administrative error allowed COVID-19 test results to be sent to a local business. NHS Orkney has sent notices to data breach victims and notified governing authorities of the incident. In response, the organization is instituting new data management policies meant to prevent a similar incident in the future. This privacy violation comes at a critical time as COVID-19 testing is seen as a way to contain the virus, but it will be more difficult to convince people to be tested if they are worried about privacy violations as part of the process.
Individual Risk: 2.768 = Moderate
The agency declined to detail the specific information transmitted in the breach, but medical tests often include patients’ most sensitive personal information. Even though this information was only transmitted to one outside business, those impacted should know that this information could be used in a variety of nefarious ways if it fell into the wrong hands. Therefore, they should continue to monitor their accounts and credentials for signs of misuse.
Customers Impacted: 51
How it Could Affect Your Customers’ Business: While many employees present a severe data security vulnerability, companies can transform team members into cybersecurity assets by providing the right training. However, these initiatives are useless if they are implemented after a breach. Instead, organizations should make phishing scam and data management training a top priority from day one.
ID Agent to the Rescue: Designed to protect against human error, Bullphish ID simulates phishing attacks and manages security awareness training campaigns to educate employees, making them the best defense against cybercrime. Learn more here: https://www.idagent.com/bullphish-id.
The Week in Breach: Australia & New Zealand
New Zealand – Earthquake Commission
Exploit: Accidental data sharing
Earthquake Commission: Crown Entity
Risk to Small Business: 1.616 = Severe
The Earthquake Commission has come under public scrutiny after the organization accidentally shared peoples’ personal information with a company lawyer and their client. The organization was quick to blame an employee who failed to implement data security stopgaps intended to prevent such an error. The breach has been a PR disaster for the company, which has been slow to notify victims and repair the damage. As a result, the Earthquake Commission is experiencing media scrutiny and intense customer blowback as those angered by the incident speak publicly about their frustration with the company.
Individual Risk: 2.101 = Severe
The breach exposed customers personal data, including names, addresses, and payment details. Victims should carefully monitor their accounts for potential misuse, while continuing to press the company to take necessary steps to secure this information.
Customers Impacted: 8,000
How it Could Affect Your Customers’ Business: Data breaches are expensive, but the less-quantifiable reputation damage that always accompanies a breach can be equally problematic. As this incident demonstrates, today’s consumers have little patience for cybersecurity lapses, and they are not assuaged by apologies. Therefore, businesses wanting to thrive in today’s digital environment need to be proactive about data security, considering it a critical customer demand in 2020 and beyond.
ID Agent to the Rescue: It’s critical that your SMB customers understand the importance of cybersecurity. Goal Assist is an expansion of our White Glove Support that includes hands-on assistance with your direct sales interactions. Let us help to ensure you are getting the most from your Partnership selling Dark Web ID. ID Agent’s Partner Success Team will set you up for the win! Learn more here: https://www.idagent.com/goal-assist.
The Week in Breach Risk Levels
1 – 1.5 = Extreme Risk
1.51 – 2.49 = Severe Risk
2.5 – 3 = Moderate Risk
1.51 – 2.49 = Severe Risk
2.5 – 3 = Moderate Risk
Risk scores for The Week in Breach are calculated using a formula that considers a wide range of factors related to the assessed breach.
Bit by bit helps client networks run smooth and secure.. visit our website at www.bitxbit.com/texas 877.860.5863
No comments:
Post a Comment